Intelligent event collection for cloud-based malware detection
An anti-malware application detects and remediates malware. The anti-malware application detects an event associated with a process and determines if the event matches an entry in an exclusions list. If the event is absent from the exclusions list, the anti-malware application monitors the operation of the process, logs the event data in an event log, and sends the event to a server to determine whether the process corresponds to malware. The anti-malware application updates the exclusions list based on the logged event if the process does not correspond to malware. The anti-malware application restores a file edited by the process to the saved copy of the original file prior to the file being edited by the process if the process corresponds to malware.
1. A method for detecting malware comprising:
detecting a plurality of events, each event associated with a process performing an operation on a file having a particular predefined characteristic;
determining if each event of the plurality of events associated with the process matches an entry in an exclusions list;
responsive to determining that each event of the plurality of events associated with the process is absent from the exclusions list, logging a plurality of event data describing the plurality of events associated with the process in an event log on a client device and sending the plurality of event data to a server;
receiving, by the client device, an indication from the server of whether the process corresponds to malware based on whether the plurality of event data includes a pattern of events indicative of malware; and
responsive to the received indication indicating that the process does not correspond to malware:
maintaining, by the client device, a count of logged events corresponding to historical operations by the process performed on files having the particular predefined characteristic on the client device, and
responsive to the count exceeding a threshold, adding an entry to the exclusions list stored on the client device to exclude future operations by the process on files having the particular predefined characteristic.
2. The method of claim 1 , wherein the exclusions list includes an entry excluding events associated with a trusted process and determining if each event matches the entry in the exclusions list comprises:
determining that an identifier of the process matches an identifier of the trusted process.
3. The method of claim 1 , wherein the exclusions list includes an entry excluding events associated with a trusted process operating on a file having a first particular characteristic and determining if each event matches the entry in the exclusions list comprises:
determining that an identifier of the process matches an identifier of the trusted process and that the operated-on file has the first particular file characteristic.
4. The method of claim 3 , wherein the first particular file characteristic is one among a file type and a file directory.
5. The method of claim 1 , wherein updating the exclusions list is performed periodically after a first period of time, the method further comprising:
logging additional event data describing additional events in the event log occurring over a second period of time greater than the first period of time; and
purging the event data occurring over the second period of time that is greater in age than the first period of time from the event log.
6. The method of claim 1 comprising:
detecting a second event associated with a second process performing a second operation on a second file;
determining if the second event associated with the second process matches an entry in the exclusions list;
responsive to determining that the second event associated with the second process is absent from the exclusions list, logging second event data associated with the second process in the event log on the client device and sending the second event data to the server;
receiving, by the client device, an indication from the server of whether the second process corresponds to malware; and
responsive to the received indication indicating that the second process corresponds to malware, remediating the second process.
7. A non-transitory computer-readable storage medium storing instructions for detecting malware, the instructions when executed by a processor cause the processor to perform steps including:
detecting a plurality of events, each event associated with a process performing an operation on a file having a particular predefined characteristic;
determining if each event of the plurality of events associated with the process matches an entry in an exclusions list;
responsive to determining that each event of the plurality of events associated with the process is absent from the exclusions list, logging a plurality of event data describing the plurality of events associated with the process in an event log on a client device and sending the plurality of event data to a server;
receiving, by the client device, an indication from the server of whether the process corresponds to malware based on whether the plurality of event data includes a pattern of events indicative of malware; and
responsive to the received indication indicating that the process does not correspond to malware:
maintaining, by the client device, a count of logged events corresponding to historical operations by the process performed on files having the particular predefined characteristic on the client device, and
responsive to the count exceeding a threshold, adding an entry to the exclusions list stored on the client device to exclude future operations by the process on files having the particular predefined characteristic.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the exclusions list includes an entry excluding events associated with a trusted process and determining if each event matches the entry in the exclusions list comprises:
determining that an identifier of the process matches an identifier of the trusted process.
9. The non-transitory computer-readable storage medium of claim 7 , wherein the exclusions list includes an entry excluding events associated with a trusted process operating on a file having a first particular characteristic and determining if each event matches the entry in the exclusions list comprises:
determining that an identifier of the process matches an identifier of the trusted process and that the operated-on file has the first particular file characteristic.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the first particular file characteristic is one among a file type and a file directory.
11. The non-transitory computer-readable storage medium of claim 7 , wherein updating the exclusions list is performed periodically after a first period of time, the instructions further comprising:
logging additional event data describing additional events in the event log occurring over a second period of time greater than the first period of time; and
purging the event data occurring over the second period of time that is greater in age than the first period of time from the event log.
12. The non-transitory computer-readable storage medium of claim 7 , the instructions further including:
detecting a second event associated with a second process performing a second operation on a second file;
determining if the second event associated with the second process matches an entry in the exclusions list;
responsive to determining that the second event associated with the second process is absent from the exclusions list, logging second event data associated with the second process in the event log on the client device and sending the second event data to the server;
receiving, by the client device, an indication from the server of whether the second process corresponds to malware; and
responsive to receiving an indication that the second process corresponds to malware, remediating the second process.
13. A computing system comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions for detecting malware, the instructions when executed by the processor cause the processor to perform steps including:
detecting a plurality of events, each event associated with a process performing an operation on a file having a particular predefined characteristic;
determining if each event of the plurality events associated with the process matches an entry in an exclusions list;
responsive to determining that each event of the plurality events associated with the process is absent from the exclusions list, logging a plurality of event data describing the plurality of events associated with the process in an event log on a client device and sending the plurality of event data to a server;
receiving, by the client device, an indication from the server of whether the process corresponds to malware based on whether the plurality of event data includes a pattern of events indicative of malware; and
responsive to the received indication indicating that the process does not correspond to malware:
maintaining, by the client device, a count of logged events corresponding to historical operations by the process performed on files having the particular predefined characteristic on the client device, and
responsive to the count exceeding a threshold, adding an entry to the exclusions list stored on the client device to exclude future operations by the process on files having the particular predefined characteristic.
14. The computing system of claim 13 , wherein the exclusions list includes an entry excluding events associated with a trusted process and determining if each event matches the entry in the exclusions list comprises:
determining that an identifier of the process matches an identifier of the trusted process.
15. The computing system of claim 13 , wherein the exclusions list includes an entry excluding events associated with a trusted process operating on a file having a first particular characteristic and determining if each event matches the entry in the exclusions list comprises:
determining that an identifier of the process matches an identifier of the trusted process and that the operated-on file has the first particular file characteristic.
16. The computing system of claim 13 , wherein updating the exclusions list is performed periodically after a first period of time, the instructions further comprising:
logging additional event data describing additional events in the event log occurring over a second period of time greater than the first period of time; and
purging the event data occurring over the second period of time that is greater in age than the first period of time from the event log.
17. The computing system of claim 13 , the instructions further including:
detecting a second event associated with a second process performing a second operation on a second file;
determining if the second event associated with the second process matches an entry in the exclusions list;
responsive to determining that the second event associated with the second process is absent from the exclusions list, logging second event data associated with the second process in the event log on the client device and sending the second event data to the server;
receiving, by the client device, an indication from the server of whether the second process corresponds to malware; and
responsive to the received indication indicating that the second process corresponds to malware, remediating the second process.